I, the Honourable Sam Mostyn AC, Governor‑General of the Commonwealth of Australia, acting with the advice of the Federal Executive Council, make the following regulations.
Dated 13 November 2025
Sam Mostyn AC
Governor‑General
By Her Excellency’s Command
Michelle Rowland
Attorney‑General
Contents
Part 1—Preliminary
1 Name
2 Commencement
3 Authority
4 Schedules
5 Definitions
Part 2—Interpretation
6 Consumer credit liability information
7 Small business operators treated as organisations
8 State authorities treated as organisations
9 State instrumentality treated as an organisation
10 Meaning of credit provider
11 Meaning of credit reporting business
12 Meaning of repayment history information
Part 3—Credit reporting
13 Use or disclosure of credit reporting information
14 Permitted disclosure of credit information to a credit reporting body
Part 4—Dealing with personal information in emergencies and disasters
15 Designated secrecy provisions
Part 5—Australian Privacy Principles
16 Exceptions to Australian Privacy Principle 9.1—adopting payroll numbers for the provision of superannuation services
17 Exceptions to Australian Privacy Principle 9.2—using and disclosing payroll numbers for the provision of superannuation services
18 Exceptions to Australian Privacy Principle 9.2—accessing Centrelink Confirmation eServices (entitlement to concessions, services or assistance)
19 Exceptions to Australian Privacy Principle 9.2—accessing Centrelink Confirmation eServices (entitlement to early release of superannuation)
Part 6—Application provisions
20 Application of this instrument as originally made
(1) Each provision of this instrument specified in column 1 of the table commences, or is taken to have commenced, in accordance with column 2 of the table. Any other statement in column 2 has effect according to its terms.
Commencement information
Column 1 Column 2 Column 3
Provisions Commencement Date/Details
The whole of this instrument 1 April 2026. 1 April 2026
Note: This table relates only to the provisions of this instrument as originally made. It will not be amended to deal with any later amendments of this instrument.
(2) Any information in column 3 of the table is not part of this instrument. Information may be inserted in this column, or information in it may be edited, in any published version of this instrument.
3 Authority
This instrument is made under the Privacy Act 1988.
4 Schedules
Each instrument that is specified in a Schedule to this instrument is amended or repealed as set out in the applicable items in the Schedule concerned, and any other item in a Schedule to this instrument has effect according to its terms.
5 Definitions
Note: A number of expressions used in this instrument are defined in the Act, including the following:
(a) agency;
(b) contracted service provider;
(c) government related identifier;
(d) organisation;
(e) small business operator.
In this instrument:
Act means the Privacy Act 1988.
Australian Retirement Trust means:
(a) the Trustee for Australian Retirement Trust Pty Ltd (ABN 60 905 115 063); or
(b) a payroll contractor of that entity, acting in that capacity.
AustralianSuper means:
(a) the Trustee for AustralianSuper (ABN 65 714 394 898); or
(b) a payroll contractor of that entity, acting in that capacity.
AvSuper means:
(a) the trustee for AvSuper Fund (ABN 84 421 446 069); or
(b) a payroll contractor of that trustee, acting in that capacity.
Centrelink Confirmation eServices scheme means the scheme of that name that is administered by Services Australia.
Centrelink program has the same meaning as in the Human Services (Centrelink) Act 1997.
Customer Reference Number, for an individual, means the number assigned to the individual, in relation to a Centrelink program, by the Department administered by the Minister who administers the Human Services (Centrelink) Act 1997.
Note: A Customer Reference Number is a government related identifier.
DVA File Number, for an individual, means a file number assigned to the individual by the Department administered by the Minister who administers the Veterans’ Entitlements Act 1986.
Note: A DVA File Number is a government related identifier.
DVA unique identification number, for an individual, means the unique identification number assigned to the individual by the Department administered by the Minister who administers the Veterans’ Entitlements Act 1986.
Note: A DVA unique identification number is a government related identifier.
HomeStart Finance means the body with that name established by regulation 4 of the Housing and Urban Development (Administrative Arrangements) (HomeStart Finance) Regulations 1995 (SA).
Indigenous person means a person who is:
(a) a member of the Aboriginal race of Australia; or
(b) a descendant of an Indigenous inhabitant of the Torres Strait Islands.
NT Home Ownership means:
(a) NT Home Ownership (ABN 85 169 745 141); or
(b) an agent of that entity, acting in its capacity as agent.
payroll contractor, of an organisation (the principal organisation), means an organisation that is responsible, under a contract, for processing, on behalf of the principal organisation, any payments that are:
(a) received by, or on behalf of, the principal organisation; and
(b) made by:
(i) an agency; or
(ii) an agent of an agency, acting in its capacity as agent; or
(iii) a contracted service provider for a Commonwealth contract, acting for the purposes of the provision of services to an agency under the Commonwealth contract; and
(c) made for the benefit of an individual employed, or formerly employed, by the agency.
payroll number, for an individual, means an identifier that is:
(a) assigned to the individual by:
(i) an agency; or
(ii) an agent of an agency, acting in its capacity as agent; or
(iii) a contracted service provider for a Commonwealth contract, acting for the purposes of the provision of services to an agency under the Commonwealth contract; and
(b) assigned for the purpose of providing salary and other employment benefits to the individual.
Note: A payroll number is a government related identifier.
residential tenancy database means a database that:
(a) stores personal information in relation to an individual’s occupation of residential premises as a tenant; and
(b) can be accessed by a person other than the operator of the database or a person acting for the operator.
Part 2—Interpretation
6 Consumer credit liability information
For the purposes of paragraph (e) of the definition of consumer credit liability information in subsection 6(1) of the Act, the following terms or conditions of the consumer credit are prescribed:
(a) how the principal and interest on the consumer credit are to be paid, namely whether:
(i) the principal and interest are to be paid in full; or
(ii) the principal and interest are to be paid, leaving a residual unpaid amount of principal and interest at the end of the term of the consumer credit; or
(iii) only the interest is to be paid;
(b) whether the term of the consumer credit is fixed or revolving;
(c) if the term of the consumer credit is fixed—the length of the term;
(d) whether the individual is a guarantor to another individual in relation to the other individual’s credit;
(e) whether the consumer credit is secured or unsecured;
(f) any variation to any of the terms or conditions mentioned in any of paragraphs (a) to (e) of this section.
7 Small business operators treated as organisations
Small business operators that operate residential tenancy databases
(1) For the purposes of subsection 6E(2) of the Act, a small business operator that operates a residential tenancy database is prescribed.
(2) For the purposes of subsection 6E(2) of the Act, the following acts or practices of a small business operator of the kind mentioned in subsection (1) of this section are prescribed:
(a) an act done, or a practice engaged in, in connection with collecting personal information for the purpose of establishing or maintaining a residential tenancy database;
(b) an act done, or a practice engaged in, in connection with maintaining personal information on a residential tenancy database;
(c) an act done, or a practice engaged in, in connection with using or disclosing personal information that is stored on a residential tenancy database.
8 State authorities treated as organisations
New South Wales
(1) For the purposes of subsection 6F(1) of the Act, the body known as Essential Energy established under the Energy Services Corporations Act 1995 (NSW) is prescribed.
Western Australia
(2) For the purposes of subsection 6F(1) of the Act, the body known as Keystart established under the Keystart Act 2024 (WA) is prescribed.
South Australia
(3) For the purposes of subsection 6F(1) of the Act, the Office of the National Rail Safety Regulator established under the Rail Safety National Law (South Australia) Act 2012 (SA) is prescribed.
Northern Territory
(4) For the purposes of subsection 6F(1) of the Act:
(a) NT Home Ownership is prescribed; and
(b) the modification of the Act set out in subsection (5) of this section is prescribed.
(5) The Act applies in relation to NT Home Ownership as if subsection 7B(5) of the Act were modified by adding, at the end of the subsection:
“; and (c) the organisation is not a contracted service provider for a State contract to which NT Home Ownership is party.”.
9 State instrumentality treated as an organisation
(1) For the purposes of subsection 6F(1) of the Act:
(a) HomeStart Finance is prescribed; and
(b) the modification of the Act set out in subsection (2) of this section is prescribed.
(2) The Act applies in relation to HomeStart Finance as if Australian Privacy Principle 11.2 did not apply in relation HomeStart Finance.
10 Meaning of credit provider
(1) For the purposes of subparagraph 6G(1)(d)(ii) of the Act, the following agencies, organisations or small business operators are prescribed:
(a) Indigenous Business Australia;
(b) the Export Finance and Insurance Corporation;
(c) the Regional Investment Corporation;
(d) NT Home Ownership.
(2) For the purposes of subsection 6G(6) of the Act, an organisation or small business operator is not a credit provider in relation to an individual if the organisation or small business operator acts in the capacity of a current or prospective landlord of the individual.
11 Meaning of credit reporting business
(1) For the purposes of subsection 6P(4) of the Act, a business or undertaking is not a credit reporting business if the business or undertaking is in a class of businesses or undertakings that:
(a) provides personal information to a credit provider; and
(b) provides the information to:
(i) verify an individual’s identity; or
(ii) validate other information relating to the individual’s financial position (such as real property assets) that the individual provides to the credit provider.
(2) A class of businesses or undertakings complies with paragraph (1)(b) if the class of businesses or undertakings:
(a) compiles information about the individual from sources, including publicly available sources; and
(b) provides the information to the credit provider to assist the credit provider to:
(i) verify the individual’s identity; or
(ii) verify that the individual owns real estate or other assets that the individual claims to own; or
(iii) validate the individual’s claimed financial position (in relation to the value of the individual’s assets).
12 Meaning of repayment history information
For the purposes of paragraph 6V(2)(a) of the Act, an individual is taken not to have met an obligation to make a monthly payment that is due and payable in relation to consumer credit if the individual misses any or all repayments due in a month, irrespective of the actual payment cycle for that obligation.
Part 3—Credit reporting
13 Use or disclosure of credit reporting information
For the purposes of paragraph 20E(4)(a) of the Act, the following credit providers are prescribed:
(a) Indigenous Business Australia;
(b) the Regional Investment Corporation;
(c) NT Home Ownership.
14 Permitted disclosure of credit information to a credit reporting body
(1) For the purposes of subparagraph 21D(2)(a)(i) of the Act, a credit provider is prescribed if the credit provider discloses the credit information in connection with the provision of commercial credit.
(2) For the purposes of subparagraph 21D(2)(a)(i) of the Act, the following credit providers are prescribed:
(a) Indigenous Business Australia;
(b) if the Regional Investment Corporation is not a member of, or subject to, a recognised external dispute resolution scheme—the Regional Investment Corporation;
(c) NT Home Ownership.
(3) For the purposes of subparagraph 21D(3)(c)(i) of the Act, the following credit providers are prescribed:
(a) Indigenous Business Australia;
(b) the Regional Investment Corporation;
(c) NT Home Ownership.
Part 4—Dealing with personal information in emergencies and disasters
15 Designated secrecy provisions
For the purposes of paragraph (d) of the definition of designated secrecy provision in subsection 80P(7) of the Act, the following provisions of the Census and Statistics Act 1905 are prescribed:
(a) section 19;
(b) section 19A.
Part 5—Australian Privacy Principles
16 Exceptions to Australian Privacy Principle 9.1—adopting payroll numbers for the provision of superannuation services
For the purposes of Australian Privacy Principle 9.3:
(a) a payroll number for an individual is a prescribed government related identifier if the payroll number is assigned to the individual by:
(i) Airservices Australia; or
(ii) an agent of Airservices Australia, acting in its capacity as agent; or
(iii) a contracted service provider for a Commonwealth contract, acting for the purposes of the provision of services to Airservices Australia under the Commonwealth contract; and
(b) AvSuper is a prescribed organisation; and
(c) a prescribed circumstance is that a payroll number for an individual that is a prescribed government related identifier under paragraph (a) of this section is adopted by AvSuper for the purposes of the provision of a superannuation service to the individual.
17 Exceptions to Australian Privacy Principle 9.2—using and disclosing payroll numbers for the provision of superannuation services
For the purposes of Australian Privacy Principle 9.3:
(a) a payroll number for an individual is a prescribed government related identifier; and
(b) each of the following are prescribed organisations:
(i) Australian Retirement Trust;
(ii) AustralianSuper;
(iii) AvSuper; and
(c) a prescribed circumstance is that a payroll number for an individual is used or disclosed, by an organisation prescribed by paragraph (b) of this section, for the purposes of the provision of a superannuation service to the individual.
18 Exceptions to Australian Privacy Principle 9.2—accessing Centrelink Confirmation eServices (entitlement to concessions, services or assistance)
(1) For the purposes of Australian Privacy Principle 9.3:
(a) each of the following numbers for an individual is a prescribed government related identifier:
(i) a Customer Reference Number;
(ii) a DVA file number;
(iii) a DVA unique identification number; and
(b) an organisation is a prescribed organisation if the organisation:
(i) is a participant in the Centrelink Confirmation eServices scheme; and
(ii) is included in a class of organisations set out in the table in subsection (2) of this section; and
(c) a prescribed circumstance is that a number for an individual that is a prescribed government related identifier under paragraph (a) of this subsection is, with the individual’s consent, used or disclosed by an organisation prescribed by paragraph (b) of this subsection to access services provided under the Centrelink Confirmation eServices scheme to enquire whether the individual is entitled to receive a concession, service or assistance.
(2) The classes of organisations are set out in the following table:
Classes of organisations that can use or disclose Customer Reference Numbers, DVA File Numbers and DVA unique identification numbers
Item Class of organisation
1 Organisations that provide healthcare services or healthcare products, including any of the following:(a) hospitals;(b) providers of hearing products and hearing services;(c) providers of disability support services;(d) providers of counselling and mental health services;(e) providers of drug treatment and rehabilitation services.
2 Organisations that are education providers, including any of the following:(a) pre‑schools, primary schools and secondary schools;(b) providers of childcare services;(c) universities, TAFE, community colleges and other tertiary education providers;(d) adult education providers;(e) organisations that provide administrative services to education providers.
3 Organisations that provide any of the following:(a) electricity;(b) gas;(c) water;(d) telecommunications services;(e) broadband internet services.
4 Organisations that provide passenger rail services.
5 Organisations that provide motor vehicle roadside assistance services.
6 Organisations that provide trustee services.
7 Organisations that provide welfare services, including any of the following:(a) advocacy organisations;(b) organisations that provide assistance to:(i) elderly persons; or(ii) disabled persons; or(iii) immigrants and refugees; or(iv) Indigenous persons; or(v) families; or(vi) children; or(vii) persons impacted by domestic violence; or(viii) homeless persons; or(ix) prisoners.
8 Organisations that provide free or subsidised social housing, facilities management services, mortgages or accommodation services to any of the following:(a) socially or economically disadvantaged persons;(b) elderly persons;(c) disabled persons;(d) Indigenous persons.
9 Organisations that provide legal aid services, including any of the following:(a) legal aid organisations operated by the Commonwealth government, or the government of a State or Territory;(b) legal practitioners who provide services for or on behalf of legal aid organisations;(c) a court of the Commonwealth, a State or a Territory.
10 Organisations that provide services on behalf of local government.
11 Organisations that provide any of the following:(a) financial planning services;(b) financial products and services (including brokers);(c) insurance products and services;(d) banking services and loans as a credit union;(e) subsidised or reduced interest loans.
19 Exceptions to Australian Privacy Principle 9.2—accessing Centrelink Confirmation eServices (entitlement to early release of superannuation)
For the purposes of Australian Privacy Principle 9.3:
(a) a Customer Reference Number for an individual is a prescribed government related identifier; and
(b) an organisation is a prescribed organisation if the organisation:
(i) is a participant in the Centrelink Confirmation eServices scheme; and
(ii) provides superannuation products and services; and
(c) a prescribed circumstance is that a Customer Reference Number for an individual is, with the individual’s consent, used or disclosed by an organisation prescribed by paragraph (b) of this section to access services provided under the Centrelink Confirmation eServices scheme to enquire whether the individual is entitled to the early release of superannuation on the ground of financial hardship.
Part 6—Application provisions
20 Application of this instrument as originally made
Sections 16, 17, 18 and 19 (which provide for exceptions to Australian Privacy Principles) apply in relation to a government related identifier that is assigned to an individual before, on or after the commencement of this instrument.